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Abstract 

An epidemic spreading in a network calls for a decision on the part of the network members: They should 
decide whether to protect themselves or not. Their decision depends on the trade-off between their perceived risk 
of being infected and the cost of being protected. The network members can make decisions repeatedly, based on 
information that they receive about the changing infection level in the network. 

We study the equilibrium states reached by a network whose members increase (resp. decrease) their security 
deployment when learning that the network infection is widespread (resp. limited). Our main finding is that the 
equilibrium level of infection increases as the learning rate of the members increases. We confirm this result in three 
scenarios for the behavior of the members: strictly rational cost minimizers, not strictly rational, and strictly rational 
but split into two response classes. In the first two cases, we completely characterize the stability and the domains 
of attraction of the equilibrium points, even though the first case leads to a differential inclusion. We validate our 
conclusions with simulations on human mobility traces. 
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I. Introduction 



. Epidemiology research has made extensive use of disease spreading models to study how a virus propagates in 
c/3 | a human population [16:]. Shortly after the appearance of self-replicating malicious programs in computers, aptly 
named computer viruses, security researchers turned to epidemic models to study the propagation of these programs 
GUI . |[T9l . More recently, the proliferation of capable mobile devices, such as smartphones, made mobile networks 
a fertile ground for spreading malware ifTTl , ffl . The propagation characteristics of malware in such networks have 
■ been studied and countermeasures have been proposed ll28l . lfl2l . J9), ll33l . Ell . fTl . 

Countermeasures to an infection can be centrally enforced, or the decision for their adoption can be left to 
individual agents such as individual home computer users, companies, or people in a society. Centralized enforcing 
is more likely to work in tightly controlled environments, such as within a company network where the users are 
obliged to abide by the company security policy. However, when it is up to individual agents to invest in protection 
against infection lfT8l . ll23l . ll6l . E71 . there appear contradicting incentives. Although agents want to be safe against 
real or virtual viruses, they would prefer to avoid investing in security: Security not only costs money, but it usually 
also reduces the utility of the network by, for example, isolating the agent from the rest of the network, or it reduces 
k31 \ the utility of the device by, for example, slowing it down (32). Another counter-incentive is that the security of a 
5_j 1 network agent exhibits positive externalities with respect to the decisions of others: If others patch their computers, 
everyone becomes more secure, even those who do not patch their own computer. If others are vaccinated, everyone 
becomes safer, even those who are not vaccinated. Therefore, agents have an incentive to free -ride on the security 
investments of others, reaping the benefits without paying the costs. More background on computer network security 
and individual incentives can be found in two recent books 151, ||8l. 

However, to the best of our knowledge, only static incentives of agents have been studied: Users are modeled 
as only making a once-and-for-all decision to install or not a security product. Herein lies our goal: Agents do 
not choose only once whether they will invest in security or not. They balance between the cost and benefit of 
their investment, and the cost and benefit typically change with time. Security advisories exist about current and 
newly emerging threats in popular technology products EJ, 0]], and about current and newly emerging human 
epidemics Q. We study how changing incentives influence the security decisions and the resulting infection level 
in the network. 

This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version 
may no longer be accessible. 
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We model agents as more likely to invest in security when the infection level is high and as less likely to invest, 
or more likely to divest, when the infection level is low. On the one hand, if people receive news of an ongoing 
epidemic, they are much more willing to protect themselves: the prevalence of AIDS has been observed to increase 
risk avoidance, either through increased condom use (4], or through behavioral risk avoidance OTTl . 

On the other hand, when the infection has subsided and there is no clear danger, complacency may set in with a 
consequent reduction in the efforts and capital expended to ensure safety. Neglect of human epidemics that are at 
the point of near extinction has led to their resurgence lfl"5l . Also, companies and users are not easily convinced to 
buy security products ||29l . If the threat is not extremely clear or imminent ("One solution [for selling security] is to 
stoke fear." |29l ), users will resist investing in security, they will divest, or they will stop renewing their investment. 

In human epidemic modeling it has already been recommended ifTOl to incorporate into models the changing 
behavior of humans towards protection against ongoing epidemics. In a recently proposed model lfl3l . the awareness 
for the epidemic spreads in parallel with the disease itself. In particular, the awareness is spread from the aware to 
the unaware part of the population at some rate and then lost again or forgotten at a different rate. Aware users are 
less likely to contract the disease because, for example, they choose to stay at home. Nevertheless, we note that a 
user alternates between states of awareness and unawareness mechanically, without making the decision himself, 
so we cannot speak of individual incentives in this case. 

In this paper, we model individuals' changing responses that depend myopically on the fluctuating infection 
level in an ongoing epidemic. We combine the epidemic propagation with a game theoretic description of the user 
behavior into an Ordinary Differential Equation (ODE) model. 

We find that the network reaches an endemic equilibrium, that is, an equilibrium where the infection persists. 
We reach the counterintuitive conclusion that the higher the learning rate (the rate at which users learn what the 
infection level is), the higher the infection level at the equilibrium. The effect of the learning rate is less pronounced 
when the users are more conservative, i.e., when they are willing to invest in protection at lower infection levels. 
These conclusions hold across the various user behavior functions that we model. 

When users are strictly rational cost minimizers, leading to discontinuous best response dynamics, our model 
turns into a system of differential inclusions, which can also be viewed as a switched nonlinear system |[24l . We 
prove that there can be no periodic solutions, there can only be equilibrium points. We characterize the domains 
of attraction for these points, as well as prove (local) asymptotic stability results. These findings, presented in 
Section [Till might also be of theoretical interest for switched nonlinear systems, as the bulk of the research on 
switched systems is focused on the linear case 12511 . 

To account for users who are not strictly rational, we study behavior functions that are continuous. These functions 
are arbitrary except for the requirement that users be more willing to become and stay protected as the current 
level of infection increases. We prove system properties that are similar to those in the strictly rational case. 

We use simulations on human mobility traces to confirm our main theoretical conclusion that a higher learning 
rate leads to a higher infection level. 

To account for heterogeneity among users, we also study a system with two classes of users (easily extensible 
to more than two), each with a different sensitivity to the infection level: Users in the first class (Responsible) 
become protected at lower levels of an infection, whereas users in the second class (Selfish) become protected only 
at higher levels, thus in a sense free-riding on the security investment of the first class. In this case, too, it holds 
that a higher learning rate leads to a higher infection level, which we also confirm with simulations. 

The remainder of the paper is organized as follows. In Section JI] we describe our model for the evolution of the 
network state, comprising an epidemic propagation component and a user behavior component. We study users with 
a strictly rational behavior (Section Hill ), then users with non-strictly rational behavior (Section ITVl ). followed by 
users with heterogeneous behavior (Section |VT). In Section IVTl we present an empirical validation of our conclusions 
through simulations on human mobility traces. 

II. Model for Epidemic Propagation and User Behavior 
A. Epidemic Propagation 

There are N users in the network. Each user can be in one of three states: 

• Susceptible, denoted by S: The user does not currently deploy security and is not infected. 
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Event 


Effect Ax 


Meeting between S and I 
Update of S 
Update of P 
Disinfection of I 


U-1,+1,0) 
q(-psp(x),0,+psp(x)) 
jr(+pps(x),Q, -p PS {x)) 
£(0,-1, +1) 



TABLE I: Possible events and their effect on the network state 



• Infected, denoted by /: The user is infected by the virus and will spread it to any susceptible user he makes 
contact with. 

• Protected, denoted by P: The user deploys security and is therefore immune to the virus. 

The number and fraction of users in each state are denoted, respectively, by Ns, Nj, Np and S, I, P. It follows 
that Ns + Ni + N P = N and S + I + P = 1. The state of the network is x = (S, I, P), and the set of possible 
states isX = ^N 3 = {^,^,^}. 

The evolution of the network state x is described as a Continuous Time Markov Process, as follows. With each 
user a Poisson alarm clock of rate /3 + 7 + 5 is associated. When the clock of user i rings - say at time t - one 
of three events happens: 

M With probability p + ^ +s , user i has a meeting with another user, chosen uniformly at random. If the meeting is 

between a Susceptible and an Infected user, the Susceptible user becomes Infected. Otherwise nothing happens. 
U With probability /3+ ^ +i5 , user i receives an update about the network state x, and he has the opportunity to 

revise his current strategy if his state is S or P. If i's state is S, he switches to P with probability psp{x). 

If i's state is P, he switches to S with probability pps{x). If i is Infected, nothing happens. 
D With probability f 5+ f f+s , user i has a disinfection opportunity. That is, if i is Infected, he becomes disinfected, 

and we assume he becomes Protected. If i is not Infected, nothing happens. 
Table U summarizes the possible events and their effect on the network state. 

We consider the large population scenario, i.e., the limit N — > 00. Kurtz E2l and Ljung [26] show that, when 
N — > 00, the Continuous Time Markov Process described previously converges to a deterministic function, which 
is the solution to a system of Ordinary Differential Equations: 

-/3 SI - 'ySpsp(x) + "/Ppps(x) (la) 

PSI - SI (lb) 

51 + ~fSpsp(x) - -yPpps(x) (lc) 
Since S+I + P = 1, we can eliminate one of the three state variables. We eliminate P, and the system becomes 



dt 

±1 

dt 
dt 



-S = -PSI - -fSpsp(x) + 7(1 - S - I)pps(x) (2a) 

j t I = PSI - 51, (2b) 

together with P = 1 — S— I. The state space isD = (5, /), < S,I < 1, S+ 1 < 1, and it is bounded. This system 
is two dimensional and autonomous. Note that for 7 = 0, the model is identical to the standard SIR epidemic model 
[ 1 6| (R stands for Recovered). 

Remark: The results of Kurtz and Ljung hold when the resulting deterministic equations are continuous. As 
we will see when discussing the behavior of users (Sec. III-B b . the functions pps{x) and psp(x) can also be 
discontinuous, and indeed multivalued at the discontinuity. Gast and Gaujal |[T4l prove a similar convergence result 
for the multivalued case: the trajectory of the stochastic system converges in probability to a solution of a differential 
inclusion, as opposed to a differential equation. If the solution is unique, the stochastic system converges to it so 
the situation is as in the continuous case. If there are multiple solutions, then the stochastic system can converge 
to any of them. In the section on the discontinuous dynamics, we will resolve the issue of uniqueness of solutions. 
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We will denote the right-hand side of the system (0 by F(x), and we will slightly abuse the notation for x to 
be x = (S, I), x G D. So, the system © will be written 

±-x = F(x) (3) 
at 

for the differential equation, or 

^-x G F{x) (4) 
at 

for the differential inclusion; the one we refer to will be clear from the context. 
B. User Behavior 

As can be seen from the epidemic propagation model, the only point at which the users can make a choice is 
at an update event. We assume that there is a cost c/ associated with becoming Infected, and a cost cp associated 
with becoming Protected. It holds that cj > cp > 0. There is no cost for being Susceptible. Note that these costs 
need not be the actual costs; what influences the decisions of users are the costs as perceived by the users. 

If we assume that each user behaves strictly rationally, the choice between Susceptible and Protected depends 
on which state minimizes the user's expected cost. Specifically, given the aforementioned model of random pair 
meetings, a user's expected cost at a particular network state x = (S,I) is cp if he chooses to be Protected and 
Icj if he chooses to be Susceptible, thus risking infection. Therefore, the user's decision would be S if Icj < cp, 
and P if Ici > cp. In this case, the functions psp(x) and pps{x) would be step functions of I: 

Psp(x) = psp(I) = 1{Ici > c P } (5) 

Pps(x) = pps(I) = 1{Ici < c P }. (6) 

If Icj = cp, then both choices are optimal, and any randomization between them is also optimal. So, when 
Icj = cp, the functions psp{F) and pps(F) are multivalued. For convenience, we define 

r = -■ (V) 

ci 

Note that if we were to set I* to a value larger than 1, then psp would always be equal to 0, pps would always be 
equal to 1, and our model would be identical to the SIRS model [ 16 1. We revisit this connection when discussing 
equilibrium points whose /-coordinate is less than /* (Section IIII-CI ). 

To account for users that cannot be assumed to be strictly rational, or their perception of the cost is not crisp (e.g., 
they are not sure about the exact values of cj and cp), or they take the network state report to not be completely 
accurate, we consider a different scenario for the functions psp{-) and pps(-)- We assume that they can be arbitrary 
functions of /, as long as the former is non-decreasing with / and the latter is non-increasing with /. 

Finally, to account for users with different characteristics, we will consider multiple user classes, each with a 
different (discontinuous) response function. 

In what follows, first we will consider the case that psp{-) and pps{-) are discontinuous step functions and 
actually multivalued at the discontinuity. Then, we will consider the case that they are continuously differentiable. 
Last, we will go into the multiple user class scenario. 

III. The Users are Strictly Rational 
The best response correspondence dictates the shape of psp(F) and pps{I): 



'0, /</* 
Psp(I) = I [0,1], 1 = 1* pps(I) = 

i, i>r 

We now have to solve the differential inclusion (recall © and (0])) 

d 



1, I <I* 

[0,1], 1 = 1*. (8) 
0, I > I* 



-x G F(x),x G D. (9) 

The vector field of F(x) is plotted in Figure Q] for various values of the parameters. 

We define a partition of the state space D into three domains: D~ = Dt~){(S, I), I < I*}, D + = Dt~){(S, I), I > 
I*}, and L = D D {(S, I) .1 = 1*}. The domain L will also be referred to as the discontinuity line. 
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A. Existence of Solutions 

A solution for this differential inclusion ifTTI is an absolutely continuous vector function x(t) defined on an 
interval J for which 4ix(t) G F(x(t)) almost everywhere on J. From the theory of differential inclusions we know 
that a solution of Q exists if, for every x G D, the basic conditions apply: The set F(x) is nonempty, bounded, 
closed, convex, and the function F is upper semi-continuous. 

A set-valued function f(x) is called upper semi-continuous at the point x if p(f(x'),f(x)) — > as x' — > x. 
The function p(A, B) is one characterization of the distance between two nonempty closed sets A and B: 

p(A, B) = sup inf d(a, b), (10) 

aGAbeB 

where d(-, •) is the Euclidean distance between two points. 
The basic conditions apply in our case: 

For every x ^ L, the set F(x) is a singleton, hence, it is nonempty, bounded, closed, and convex; additionally, 
the function F is continuous at x, hence, it is also upper semi-continuous. 
At each point x G L, the set F(x) is the segment 

pi q r ,_(-psi* + j[-s,i-s-i*]\ 

which is the smallest convex closed set containing all the limit values of F(x') for x' — > x G L. When x' — > x 
from D + , the limit value of F(x) is 

f-psi* - 75 

\ PSI* - 51* 

and when x' — > x from D~, the limit value of F{x) is 

f-psr + 7(1 - s - 1*) 

\ PSI* - 51* 
The set F(S,I*) is bounded and upper semi-continuous IfTTI Lemma 3, §6]. 

B. Uniqueness of Solutions 

In general, because the right-hand side of © is multivalued, even though two solutions at time to are both at 
the point x , they may not coincide on an interval t < t < t\ for any t\ > t . If any two solutions that coincide at 
to also coincide until some t\ > to, then we say that right uniqueness holds at (to,xo). Left uniqueness at (to,xo) 
is defined similarly (with t\ < to), and (right and left) uniqueness in a domain holds, if it holds at each point of 
the domain. 

The solution is unique in D~ and in D + because F has continuous partial derivatives there. 

We will now show when a solution of © lying on the line of discontinuity L can be uniquely continued in the 
direction of increasing t. We will see that all solutions can be uniquely continued, except those that start at the 
point (S,I) = Those latter solutions all start at the same point and then diverge, but none of them can 

ever approach that point again in the positive direction of time (the proof is in Lemma Q]). So, if we ignore the 
initial point of those solutions, all solutions can be uniquely continued. 

Formally, let F~(x) and F + (x) be the limiting values of the function F at a point x G L as F approaches x 
from D~ and from D + , respectively. Let h(x) = F + (x) — F~(x), and FZ, Ft, be the projections of the 
vectors F~, F + , h onto the vector n = (0, 1) T , the normal to L directed from D~ to D + at the point x. 



The values of these vectors and projections are: 

F~(x) = (-pSI* + 7(1 - S - I*),/3SI* - 5I*) T (14) 

F+(x) = {-pSI* - 7 5, psr - 5F) T (15) 

h(x) = (- 7 S- 7 (l-S-F),0) T (16) 

F~ = PSI* - 51* (17) 

F+ = pSI* - 51* (18) 

h N = (19) 
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We know ifTTl §10, Corollary 1] that on the discontinuity line L, at the points where FZ > 0, Ft > (or 
Fjy < 0, F£ < 0) the solutions pass from D~ into D + (correspondingly, from D + into D~) and uniqueness is 
not violated. So, at no point of L is uniqueness violated, except at (S, I) = (4,/*). 

A solution that passes from the point (S, I) = (4, I*) will either stay there (if G F(4, i"*), i.e., if (4, /*) is an 
equilibrium point) or it can be continued in multiple ways, all tangent to L as jgl = when 5=4. Each of these 
multiple solutions corresponds to a different value of F(4, /*). More details on these trajectories can be found in 
the proof of Lemma Q] 
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(a) The case 8 > /3. The only equilibrium 
point is Xo = (1,0). It is stable and all 
trajectories converge to it. 




I S 



(b) The case 5 < (3 and P > ^—f-. The 



point X 1 



is a stable equilib- 



rium point, similarly to the SIRS model. 



7 = 




7 = 7* »- ■> 



(c) The case 3 < B and J* < — I 



point X 2 = f |,T 
point. 



The 

is a stable equilibrium 



Fig. 1 : The vector field of the system and the equilibrium points for all regions of the parameter space. At the point 
(S,I), an arrow parallel to (41, 4r) is plotted. In cases [(b)] and |(c)[ the point Xo = (1,0) is also an equilibrium 
point but it is unstable. All trajectories converge to X\ or X2, respectively, except those that start on the axis 1 = 0, 
which converge to Xq. 



C. Stationary Points 

The stationary points are found by solving for x the inclusion € F{x). 
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1) Stationary points above the discontinuity line: There can be no stationary points in the domain D + . The 
system becomes 

4 5 = -pSI - jS (20a) 
at 

^-1 = (3SI - 51. (20b) 
at 

From the first equation, we see that S has to be zero. But then the second equation implies that I also has to be 
zero, which is not an admissible value for / as I = cannot be above the discontinuity line. 

2) Stationary points below the discontinuity line: We look for stationary points in the domain D~. The system 
becomes 

£s = -PSI + iQ. -S- I) (21a) 
at 

±I = PSI-6I, (21b) 
at 

which is identical to the SIRS case (recall the discussion in the User Behavior section) except that the domain is 
not the whole state space, it is only D~. 
This system has the solutions: 

X = (5o,/ ) = (l,0) (22) 
X 1 = (5 1 ,I 1 )=^,^|^. (23) 
The second solution, X\, is admissible if and only if X\ 6 D~ , i.e., 



i < 1, (24) 



and also 

1 — - 

T < !*■ (25) 

7 

Note that if I = 1, then Xq and Xi coincide. Also, it is not surprising that X\ is the equilibrium point of the 
corresponding SIRS model. That is, I* does not play an explicit role in this case, as long as (T23T ) holds. 

3) Stationary points on the discontinuity line: We look for stationary points on the discontinuity line 1 = 1*, 
that is, we solve the inclusion £ F(S, I*) for S. The system becomes 

^5 = -PSI* + [- 7 5, 7 (1 - S - I* )] (26a) 

^-1 = pSI* -61*. (26b) 
at 

Since I* > 0, is zero only when S = 4. We then have to check if it is possible to make equal to zero, 
that is, if G F(^,I*). We find that it is possible when I* is such that 

1 - 4 

I* < t— X- ( 27 ) 

In that case, the stationary point is 

X 2 = (S 2 ,I 2 ) =[-,,!*) ■ (28) 
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In general, there are many combinations of psp{I*) and pps(I*) that make ^5 equal to zero, but there is always 
one with psp( I*) = 0. In that case, pps(I* 



81* 



7(i-f-/*r 



To summarize, Xo exists always. If <5 < ft, one more equilibrium point exists: X\ if I* > j^t, or X2 otherwise. 
In Figure Q] we can see these equilibrium points. 
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D. Local Asymptotic Stability 

1) Stability of Xo and X\: We show that, when 4 > 1, Xq is asymptotically stable. When 4 < 1, Xq is a 
saddle point, and if X\ exists it is asymptotically stable. 

We now examine whether Xq and X\ are (locally) stable equilibrium points. The Jacobian of the system is 

J(S,I)=(~ PI ~ 1 ~i S ~A (29) 



/3I pS - 8 



We evaluate the Jacobian at the point Xq: 



J(X ) = J(0,1) = ( 7 (30) 

The eigenvalues of J(Xq) are —7 and j3 — 5. So, Xo is stable if and only if /3 < 8, in which case note that X\ 
does not exist. 

We evaluate the Jacobian at the point X±: 

(3D 
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The eigenvalues of J(X\) are ail± V a ^ +4cLl2a21 ^ w h ere ai . wt (h e elements of J(Xi) (022 = 0). Since an < 0, 
the smallest eigenvalue is always negative. The largest one is negative if and only if 012021 < <^ /3 > 5. So X\ 
is stable whenever it exists. 

If we evaluate the square root \J a\ x + 4ai2a2i at the point /3 = 7(1 + ^) 2 — ^, we see that its argument can 
also take negative values. Since the eigenvalues are a continuous function of /3, they will have an imaginary part 
for fi close to 7(1 + J) 2 — Z, which means that the trajectories spiral towards X\. 

2) Stability of X-^: To show that the stationary point on the discontinuity line is asymptotically stable, we will 
use Theorem Q] below iTTTl §19, Theorem 3]. To use this theorem we transform the system so that the line of 
discontinuity is the horizontal axis, the stationary point is (0, 0), and the trajectories have a clockwise direction for 
increasing t. 

We set x = 4 — S and y = I — I*. The domains D,D~,D + become G = {(x,y)\x < 4,y > —I*,y — x < 
1-1*- 4}, G~ = G(~){(x,y)\y < 0}, and G+ = G(~){(x,y)\y > 0}. Then, the system can be written as 

J = P~(x, y) = -Pxy - (PI* + i)x + (7 + 8)y - 7(1 - /*) + 8(1* + 1) (32a) 
at p 



dy 
dt 

for (x, y) G G~, and 



Q-(x,y) = -f3x(y + I*) (32b) 



^ = P+ (x, y) = -Pxy - {fir + 1 )x + 5y + 5(1* + 1) (33a) 
dt p 

^ = Q+(x,y) = -fJx(y + n (33b) 

for (x,y) £ G + . 

The partial derivatives of P^, that is, of P + and of P~, are denoted by P^, P^ x , P^f etc., and similarly for Q ± . 
We define two quantities in terms of the functions P^, and their derivatives at the point (0, 0): 

^H(^-gf)- 
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Theorem 1: Let the conditions 

Q~ = Q + = 0, P~ < 0, P + > (35) 
Q~ < 0, Q+ < (36) 

be fulfilled at the point (0, 0). Then, A + — A~ < implies that the zero solution is asymptotically stable, whereas 
A + — A~ > implies that the zero solution is unstable. 

All the conditions of Theorem (fl]) are satisfied in our case, together with A + — A~ < 0. The condition P~ < 
is equivalent to d27l ), i.e., the condition on I* that causes the stationary point to be on the line of discontinuity. 
All the other conditions are straightforward to verify. For example, to prove that A + — A~ < we can quickly 
establish that A + < and A~ > 0, again using (|27T ). 

Therefore, the stationary point (S,I) = (4, I*) is asymptotically stable. 



E. Domains of Attraction 

From Theorem 6, §13 ifTTTl we know that for autonomous systems on the plane, it holds that if a half trajectory 
T + is bounded, then its w-limit set Q(T + ) contains either a stationary point or a closed trajectory. Recall that the 
w-limit set of a half trajectory T + (x = cj)(t),to < t < oo) is the set of all points q for which there exists a sequence 
ti, *2, • • ■ tending to oo such that (j)(U) — > q as i — > oo. 

In this section, we show that there are no solutions that are closed trajectories. So we can conclude that all 
system trajectories converge to equilibrium points. When there is more than one equilibrium point, we show which 
trajectories converge to which point. 

The main result is that for any half trajectory T + , its w-limit set fi(T) can only contain equilibrium points, that 

is, X = (1,0), X 1 = (S 1 ,I 1 ) = ,^|), or X 2 = (f ,/*). 
We will find the following two functions useful: 

E(S,I) = S - S 1 \n(S)+I + ^ ln(7) , (S, I) G D+ (37) 

M(S,I) = S-(S 1 + l)HS + l) + I-I 1 hi(I), (S,I)eD~. (38) 

It holds that E(S,I) is constant on trajectories in the area D + , and M(S,I) is decreasing along trajectories in the 
area D~. Indeed, with some calculations it can be shown that 

d „,„ . dEdS dEdl 

dt E ^=os^ + mH = ° (39) 

±M(S I) ~ 8 — d -^ + 9 — d - ~ V> 3 -W 1 + l < (40) 
dt {b ' I} ~ dS dt + dl dt~ /3S + 7 1 + f - ( } 

First of all, we prove that a trajectory converges to Xq = (1,0) if and only if it starts on the line I = 0: If it 
starts on the line, then 4rl is zero, so I stays equal to 0, and the trajectory stays on the line. And jj^S is positive 
always except on Xq, so the trajectory converges to Xq. 

If the trajectory starts at a point (Sq,Iq),Iq > 0, then let M(Sq,Iq) = Mq. We can see that, for any 5 it holds 
that lim/^o M(S, I) = oo. So, if the trajectory comes close enough to the line 1 = 0, the function M(S, I) will 
have to increase above Mq, which is a contradiction. Therefore, the trajectory cannot converge to Xq = (1,0). 

From now on, we assume that on all points of a trajectory it holds that I > 0. 

Assume that there exists a half trajectory T + whose limit set fi(T) contains a closed trajectory T. By successively 
eliminating properties of such a trajectory, we will prove that it cannot exist. Note that Lemma Q] below is trivial 
if (4,/*) is an equilibrium point. 

Lemma 1: The point (^,1*) cannot be on V. 
Proof: 

If (S,I) = (4, J*) is on T (say, at time t\), then, first of all, ^ F(i,/*), because otherwise the point (4, I*) 
would be an equilibrium point, so it could not be part of a closed trajectory. Since ^ F(4, /*), the point X\ is 
an equilibrium and it is distinct from (4, I*). 
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We will now reach a contradiction by proving that F cannot approach (S,I) = (4, /*) for t > t\, thus F cannot 
be a closed trajectory. If G F, then the trajectory would have to exit the line L immediately after passing 



through it (otherwise right uniqueness would be violated on the points of L contained in F). 
m 

'A 



Define a region A e Cfl around (-|, /*) that includes all points where the M function has values at least equal 
to M(|, J*) - e, for some small enough e > such that A e does not include X\. Since M is continuous and X\ 



is distinct from (4, I*), A e is well defined. 

r, being a closed trajectory, has to encircle an equilibrium point (Thm. 7, §13 iTTTIO . So, it would have to exit 
A e and go around the point X\. But then, as M decreases along trajectories, F cannot reenter A e before exiting 
D~. It can only exit by crossing the line L somewhere on the interval ((^, /*), (1 — /*, I*)]. However, at (4,/*) 
the function M(S,I*) attains a minimum over S, so F cannot exit D~ because it cannot approach L. ■ 
If (S, I) = (4,1*) is not on F, then on F there holds right uniqueness. Also, Q(F) = F. 
We will continue by proving that F cannot have more or fewer than two intersection points with L. 
Lemma 2: A closed trajectory F that does not pass through the point (4, /*) cannot have either more than two 
or fewer than two intersection points with the discontinuity line L. If it has two intersection points, they cannot be 
on the same side of (4, I*). 
Proof: 

Denote by F H L = {Zi, h, ■ ■ •} the common points of F with L, and t\, £2, £3, • • • the corresponding times. 

r n L cannot be empty, because F cannot be completely contained within the area D~ , because the function 
M is decreasing in D~, nor within the area D + , because F has to encircle an equilibrium point, but there is no 
equilibrium point in D + . 

F n L cannot be a singleton set. If there is only one point in T n L, say l\, then T has to be in D~ (except 
for l\) because it has to encircle X\. Then, T has to exit L immediately, otherwise it would have more than one 
common points with L. If T exits an e-neighborhood of l\, then, using the function M(S,I) we can show that T 
cannot return in an appropriate ^-neighborhood of l\, so V cannot be closed. 

Let there be 3 or more distinct points in T n L. At least two of these points are on the same side of the point 
(4, /*), assume the side on the right (S > -|). Call them Zj and lj, and their corresponding times tj and tj. Assume 
without loss of generality that Zj is the one closer to (4,/*). Since Zj is distinct from (4,1*), there is at least one 
more point on L between (4, J*) and Z.;. Call that point a, and consider the line segment LS from a to (1 — 7*, J*). 
By construction, both Zj and lj are on LS. The segment LS is a transversal: it is intersected by trajectories only 
in one direction, as ^7 > for S > 4. Also, right uniqueness holds on the points of LS. 

By Lemma 3 §13 in iTTTi . for a trajectory T the set Q(T) can intersect the transversal LS at not more than one 
point. So, since T = Q(T), the set F n LS cannot contain more than one point, so we have a contradiction. We 
reach a similar contradiction if we assume that Zj and lj are to the left of (4,1*). ■ 

Lemma 3: A closed trajectory F cannot intersect the discontinuity line L on exactly two points that are on 
opposite sides of the point (4, J*). 
Proof: 

Call A = (Sa, I*) the point in F n L with S A < L and call B = (S B J*) the one with S B > | • 
Let T be parameterized by (j)(t) = (x(t),y(t)),t £ [0, T]; also </>(0) = 4>{T). The function 4>(t) is a solution 
of the differential inclusion, that is, 4>(t) = (x(t),y(t)) G F(4>(t)),t G [0,T]. Let t A ,t B G [0,T] be such that 
A = 4>{tA) and B = </>(t_e). Let a A , a B G [0, 1] be such that x(t^) = — (3xy — + 0^7(1 — y) and x(t B ) = 
-fixy - 7X + 0^7(1 - y) 
Define the functions P(x,y) and Q(x,y), (x,y) G D\{y,y > 0}: 

P(x,y) = --y = --{(3xy-5y) = 5-f3x (41) 

y y 



Q(x,y) = -x 

y 



< y 



= 5 


-fix 








y < 


1* 




y)\ 


X < 


fry 


= L* 


y)). 


X > 


i>v 


= L* 




y > 


1* 





\(-$xy + 7(1 - x - y)), 

jj(-f3xy -jx + a B j(l 
h{-/3xy - jx), 



We compute the integral ^ Pdx + Qdy in two ways. 



1 1 



For the first computation, we use the parametrization <p(t) = (x(t),y(t)) of T, so dx = xdt and dy = ydt. The 
result is zero: m 



Pdx + Qdy 



1 



1 



—yxdt H — xydt = 0. 
V V 



(43) 



For the second computation, we split Q(x, y) into two functions, one continuous and one discontinuous, so that 

Q(x, y) = Q c (x, y) + Q d (x, y). 

(44) 



Q c (x,y) = -(-fixy - jx) 

y 



( i 



Qd(x,y) 



,7(i-i/)> y< r 
\a A i{i-y), x<t, y = r 

\a B l{l-y), x>Ly=P 



(45) 



y>I* 



So now the original integral can be split into two: <f r Pdx + Qdy = <f r Pdx + (Q c + Qdjdy = § T Pdx + Q c dy + 
§r Qddy- We use Green's theorem to compute the first integral. 



Pdx + Q c dy 



dQ c BP, , 

-r -^-dxdy 

ox ay 



-/3 - -dxdy < 0. 

y 



(46) 



For the second integral j> r Qddy, we define the function 



Qd(x, y) = - 7 (1 - y), (x, y) G D \ {y, y > 0} 



(47) 



and the curves T\ and T2: The curve Ti is the trajectory T restricted to y < I*. The direction of T\ is from A to 
B. The curve T2 is the line segment of L joining B and A, with direction from B to A. 
Observe that 



/ Qddy = I Qf'dy = [[ ^^dxdy = 
Jr ~/r!ur 2 J Jr 1 ur 2 ° x 



(48) 



where the first equality follows from Qj = Q d xt on Ti and dy = on T2, whereas the last equality follows from 
Green's theorem, because Q^ xt is continuously differentiable. 

We see that the result of (l43l contradicts the result of (l46l ) and (l48l . So, the trajectory F with the assumed 
properties cannot exist. 



From the previous lemmata, we conclude that there can be no closed trajectory T. Therefore, all trajectories have 
to converge to equilibrium points. 



F. Conclusion 

In Figure |2] we see that the total fraction I = of Infected at the system equilibrium increases with the 

update rate 7, until / becomes equal to the threshold I* . The reason for this increase is that, when the equilibrium 
value of / is below I*, the trajectories will eventually be completely contained in the domain D~ (below /*). In 
this domain, at each time a Protected is informed about the value of /, he will choose to become Susceptible, 
thus fueling the infection. In parallel, no Susceptible will choose to become Protected. The larger the value of 7, 
the shorter time a user will spend being Protected, thus the smaller the fraction of Protected. However, a smaller 
fraction of Protected implies a larger fraction of Infected, as the fraction of Susceptible at equilibrium is necessarily 
4, i.e., it is independent of 7. 

When the quantity j-p- exceeds I*, the equilibrium value of / is limited to I*; further increases of 7 have 

no effect. The explanation is that, as soon as the instantaneous value of I exceeds I , Susceptible users switch 
to Protected, and Protected users stay Protected, thus bringing the infection level below I*. However, there is no 
equilibrium point for the system in the domain D~, so the only possible equilibrium value of I is I*. For 1 = 1* 
there are in general many combinations of psp{P) and pps{I*) that lead to an equilibrium, including one with 
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Psp{I*) = and pps{I*) > 0. That combination means that no Susceptible users become Protected, but some 
Protected become Susceptible. Other combinations with both psp{I*) > and pps{I*) > would be harder to 
justify, as they imply that at the same value of I* users would switch from Susceptible to Protected and back. 

A side conclusion concerns the interaction of 7 with I*: We have seen that increasing 7 will increase the 
equilibrium value of /, but I's maximum value will be limited to /*, so if /* is low, the effect of increasing 7 is 
not severe. 




IV. The Users are not Strictly Rational 

d 



The user behavior functions psp(I) andpps(I) are continuously differentiable, and we require that 4jPsp{I) > 



and 4jPsp{I) < 0. Other than that, the two functions are arbitrary. 



A. Stationary Points 

The equilibrium points of the system are found by solving for x the equation F(x) = 0: 

4s = = -PSI - jS P sp(I) + 7(1 - S - I)pps(I) (49a) 
at 

£l = = pSI- 51 (49b) 
at 

From d49b| ) we see that either / = or S = 4. 

• Equilibrium point Xq 

Substituting 1 = into d49at . we have that X = (S ,I ) = ( Psp (o)+pls(o) '°r These vames of (SoJo) are 
always admissible as they are always non-negative and at most equal to 1. 

Recalling the meaning of pps{0) and psp(0), we can reasonably expect that pps(0) = 1 and psp(0) = 0: 
Protected have no reason to remain Protected, and Susceptible have no reason to become Protected, when 
there is no infection in the network. In this case, Xq is the point (1,0). 

• Equilibrium point X\ 

Substituting S = 4 into d49ah we see that / has to satisfy 

g(I) = -51 - ^psp(I) +7(1-^-1) pps(I) = 0. (50) 

To solve g(I) = for / we need to know the two response functions psp{I) and pps(I). But even without 
knowing them, we can still prove that g(I) = has a unique solution for / G [0, 1] under the condition that 

£ < ppsB (51) 

P ~ Psp(0) + Pps(0) 
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We first show that g(I) monotonically decreases in the interval [0, 1], and then we show that, under the 
condition (I5TI ). g(0)g(l) < 0. We can then conclude that there is exactly one solution of g(I) = in the 
interval [0, 1]. 

57 9(/) = - s - jaz^M - 7Ws(7) + 7 i 1 - 1 - ') li PFs(I) (52) 

And, as jjPsp(I) > and -jjPsp(I) < 0, we can see that 

dg(I) 



dl 

so g(I) monotonically decreases. 

Under the condition (|5TT ). g(0) is non-negative: 



< 0,VP,%8 > 0, (53) 



g(0) = -^Wp(0) +7 ( 1 - | ) pp S (0) (54) 



g(0)>0*jU Pff> (55) 

which is exactly condition d5"TT ). 

And now we prove that g{l) is always negative. 

<?(1) = S - jPsp(1) - IgPPsil) (56) 

Therefore: 

g{\) <0,V/3,7,,5>0. (57) 

Denoting by I\ the solution of g(I) = 0, we can now conclude that X\ = (S\,I\) = (^,h) is uniquely 
determined under (I5TT ). The values are admissible as they are both between and 1. Note that if (I5TT) 

does not hold then both g(0) < and g{l) < 0, so the monotonicity of g in [0, 1] implies that X\ does not 
exist. Consequently, (I5TT) is both necessary and sufficient for the existence of X\. 



B. Local Asymptotic Stability 

To examine the (local) stability of the equilibrium points Xq and X\ we compute the Jacobian of the system 
d49l ) and evaluate it at these two points. 

J(S,I)=(f f) (58) 

\J21 322 J 

where 

in =-/3I- 7(psp{I) + Pps{I)) (59a) 

ji2 =~PS- jS-^ PS p(I) - wps(I) + 7(1 - S - I)^jPsp(I) (5%) 

321 =/3I (59c) 

322 =PS - 5 (59d) 

Observe that both jn and j\2 are negative for all 5 and /: recall our assumption that dps l [ I ^ > and dp3 ^ I " > < 0- 
For the case of Xq, the Jacobian is 

T ,„s (-7(psp(0)+Pps(0)) J{X Q ) l2 \ 

( o)= o p m -s) m 

\ r psp(0)+pps(0) / 
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where the value of J(Xo)i2 is irrelevant for the calculation of the eigenvalues. The two eigenvalues of J(Xq) are 
the two diagonal entries: 

A? = -7(psp(0)+Pps(0)) (61) 

A° =13 ™® , , - 5 (62) 

The first eigenvalue, A J, is always negative except in the trivial case where psp(0) = Pps(O) = 0. The second 
one is negative if and only if 

* . pps(Q) . 

p Psp(o)+p Pa {oy { ' 



which is exactly the opposite of condition (I5T1) . So, Xq is stable when X\ does not exist. 
For the case of X\ the Jacobian is 

J(X l} = ( J ™ U J(X Q l)l2 ) (64) 
The eigenvalues have the following form: 

Ai, \\ = \ (j(Xi)n ± y^M + wSS) (65) 

They are both negative, since J(X{)\\ and J{X\)i2 are negative as mentioned before. So, Xi is stable whenever 
it exists. 

C. Domains of Attraction 

Since the system is two-dimensional and F is continuously differentiable, we can use Dulac's criterion to show 
that the system can have no periodic trajectory. 

Theorem 2 (Dulac's criterion): Let A be a simply connected domain. If there exists a continuously differentiable 
function h : A — > R such that V • (hF) is continuous and non-zero on A, then no periodic trajectory can lie 
entirely in A. 

In our case, the domain A is the state space excluding the line 1 = 0. Note that there can be no periodic trajectory 
that passes from a point with 1 = 0. We select as function h the function h(S, I) = y. We compute V • (hF) to be 

V .(hF) = -f3- - < 0,V(S,I) G A, (66) 

which is continuous and non-zero in A. Then, from Dulac's criterion, no periodic trajectory lies entirely in A, 
and, consequently, the system has no periodic trajectory at all. From the Poincare-Bendixson theorem, the system 
can only converge to a periodic trajectory or an equilibrium point; so, we can conclude that every trajectory must 
converge to an equilibrium point, that is, either to Xq or X\. 

More precisely, when ( [511 ) does not hold, only Xq exists so all trajectories converge to Xq. When (|5T| ) holds, 
both Xq and X\ exist, and Xq is a saddle point: Trajectories starting on the line 1 = approach Xq along the 
line 1 = 0, whereas all other trajectories converge to X\. Indeed, if 1(0) > 0, then the corresponding trajectory 
will have I(t) > 0, Vi > 0. The reason is that if I(to) = for some finite to > 0, then the uniqueness of solutions 
would be violated at (S (to), I (to)), because it would be a common point with the trajectories that approach Xq 
along the line / = 0. If to = oo, i.e., the trajectory with 1(0) > converges asymptotically to Xq while keeping 
I(t) > 0, then close enough to Xq we reach a contradiction as 4/ will become positive (see (IBTI ) and (I49bl l). 

D. Conclusion 

The equilibrium point Xq is unaffected by 7. We show now that, at X\ = the equilibrium level of the 

Infected increases with 7. To this end, we take the derivative ^ and we see that is always positive. 
We know that I\ satisfies g(h) = 0, i.e., 

- 5h - jpsp(h) + 7(1 - I - h)pps(h) = (67) 
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Differentiating with respect to 7, then using the chain rule, and finally collecting terms, we have 

(68) 



dh ( x j5dp S p(h) , . , 6 T sdpps(h) 

*7 V " J^h~ " ippsih) + 7(1 " " /l)_ d7T~ 



(5 (5 
= pPsp(h) - (1 - ^ - h)pps(h)- 

The term in the parenthesis on the left-hand side is negative, and so is the right-hand side. Therefore, £L. is positive. 
The negativity of the left-hand side parenthesis is deduced from dps J I ^ 11 ^ > and ^ < 0. The negativity 

of ^psp(h) - (1 - I - h)pp S {h) is deduced from £j> SP (Ji) - (1 - J - h)p PS (h) = -f /1 < 0. 

V. The Users have Different Behavior Functions 

So far, we have assumed that all users behave in the same way, which might be unrealistic in practice. In this 
section, we model the case when users are split into two classes, each with a different threshold behavior function. 
Note that we choose to have two classes to keep the presentation simple, but we believe that our results carry over 
to multiple user classes. 

A fraction a c of users are in class c = 1, 2, and 01 + 02 = 1. The fractions of Susceptible, Infected, and Protected 
in class c are denoted by S c , I c , P c , and it holds that S c + I c + P c = a c . Users do not change classes, so a user in 
S 1 will move, if infected, to I 1 and then to P l . The total fraction of Susceptible users is denoted by S(= S l + S 2 ), 
and similarly for Infected, /(= I 1 + I 2 ), and for Protected P{= P 1 + P 2 ). Susceptible users can be infected by 
an Infected user of any class, not just by an Infected of their own class. 

Users in different classes differ in their response to received alerts, i.e., the functions psp(I) and pps{I) become 
p c SP (I) and p c PS (I) for users in class c. Note that the functions depend on I, not on I c . We will study discontinuous 
best response functions with a different threshold I* c for each class. Without loss of generality, we require P 1 < I* 2 . 



Psp(I) 




I <P C 

[0, 1] 1 = r c p c P s(i) = < 

1 1 > r c 



The first class of users that we will model are users with a low threshold I* 1 = 0.1, who we call Responsible. 
Because of their low threshold, these users become Protected easily, but they do not easily switch from Protected 
to Susceptible. We call them Responsible because the way they behave helps reduce the infection. The second class 
of users, who we call Selfish, have a high threshold P 1 = 0.9. This means that they hardly ever decide to switch 
from Susceptible to Protected, whereas they almost always decide to leave the Protected state. 

In the next section, we simulate the system on human mobility traces, and we confirm our previous conclusion 
that the equilibrium level of infection increases with the update rate 7. 

VI. Simulations on Mobility Traces 

We validate our conclusions using simulations on human mobility traces. The traces that we use are Bluetooth 
contacts among 41 devices given to participants in a conference 11301 . The traces were collected over a period of 
approximately 72 hours. 

The contact rate /3 is determined by the traces. Actually, f3 is a function of time /3(t), since the number of contacts 
per time unit fluctuates depending on the time of day. We want to establish whether the fraction of Infected indeed 
increases for larger values of the update rate 7. For the simulations that follow, we set 5 = (6/ir) _1 , and we plot 
the system trajectories on the S — I plane (average of 30 simulations) for three different values of 7, (1/ir) -1 , 
(6/ir) -1 , and (24/ir)" 1 . The initial conditions for all simulations were 1 Infected and 40 Susceptible. In the case 
of two user classes, the initially Infected user is of class 2 (Selfish). Each simulation runs until either there are no 
Infected, or the end of the traces is reached. 

For the single user class case, we use a piecewise continuous response function (Figure [3]): 

/</*-§ 

-(/-/* + §) /*-§<!< I* + f (70) 

/>/* + § 
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/* 1 

Fraction / of infected users 

Fig. 3: The user response function psp{I) used in the simulations: The probability that a Susceptible user switches 
to being Protected, upon learning the fraction I of Infected users in the network. 



and pps{I) = 1 - Psp(I)- 

In Figure |4] we plot simulation results for /* = 0.1,0.5,0.9, and e = 0.001, omitting an initial transient phase. 
Since /3(t) is not constant, the system state oscillates between two equilibrium points, Xq (when f3(t) is low enough 

that S > (3(t)) and either X\ or X2, depending on whether (l25l) is satisfied or not f^+J ^ ■ Despite these 

periodicities, we see that for increasing values of 7 the system trajectories go through higher values of I, thus 
confirming our main conclusion that the infection level increases with the update rate. The effect of lowering I* is 
that it limits the maximum infection at the equilibrium, so the trajectories are capped at values of / not far above 
I*. For lower values of /*, we see that the effect of 7 on the Infected is less pronounced. 




Susceptible Susceptible Susceptible 



Fig. 4: The trajectory of the system (average of 30 simulations) on the SI plane, when 5 = (6/ir)" 1 and 7 takes the 
values (1/ir) -1 , (6/ir)" 1 , and (24/tr) . The thresholds are I* = 0.1, 0.5, 0.9. We see that the network experiences 
higher numbers of Infected devices for higher values of 7, and for I* = 0.1, 0.5 we also observe the limiting effect 
of I*. 

For the two-user class case, we use separate piecewise continuous response functions for each class. Users of 
class 1 (Responsible) have a threshold of I* 1 = 0.1 and users of class 2 (Selfish) have a threshold of I* 2 = 0.9. 
For both classes e = 0.001. 

In Figure [5] we plot the system trajectories, again omitting an initial transient phase, for the Susceptible and 
Infected of 1) the total population (first column), 2) the Responsible subpopulation (second column), and 3) 
the Selfish subpopulation (third column). Each row corresponds to a different split of the total population into 
Responsible and Selfish subpopulations. In the first row, the Responsible-Selfish split is 20%-80%, in the second 
row it is 50%-50%, and in the third row it is 80%-20%. 
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We again confirm the conclusion that the fraction of Infected in the total population increases for larger values of 
7. Two secondary conclusions relate to the situation within each subpopulation: The Selfish user trajectories seem 
as if the Selfish were isolated. That is, their trajectories are very similar to those they would follow if they were 
alone in the network (compare with the case I* = 0.9 in Figure @). The Responsible users, on the contrary, stay 
mostly in the bottom left region, which means that many of them stay Protected. Comparing with the case I* = 0.9 
in Figure @] we see that they now stay a bit closer to the bottom left corner: This means that the Selfish-caused 
infection keeps more of them Protected than if they were alone in the network. The observations on the Selfish and 
on the Responsible are mutually compatible, as users that are Protected (here, the Responsible) do not interact with 
the rest of the network, so the trajectories of the remaining users (here, the Selfish) seem as if they were isolated. 

Total Population (20,80) Responsible Selfish 




Fig. 5: The trajectory of the system (average of 30 simulations) on the SI plane, when 5 = (6/ir) -1 and 7 takes 
the values (lfor) -1 , (Qhr)~ l , and (24/ir) _1 . Users are split into two classes: the Responsible, with I* = 0.1, and 
the Selfish, with I* = 0.9. The columns correspond to the Total Population, the Responsible subpopulation, and 
the Selfish subpopulation. The rows correspond to a total population split of 20%-80%, 50%-50%, and 80%-20% 
into Responsible and Selfish. We see, as in the case of a single user class, that the network experiences higher 
numbers of Infected devices for higher values of 7. In the current case of multiple user classes, the higher number 
of Infected is mostly due to the Selfish users. 



VII. Conclusions 

We have studied the effect of network users being cost-sensitive when deploying security measures. In particular, 
if users increasingly deploy security upon learning that the level of network infection is higher, and retract the 
deployment when the level of infection drops, then a higher learning rate leads to a higher equilibrium level of 
infected users. 
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We reach this same conclusion in three scenarios. Our main scenario is when users are strictly rational cost 
minimizers, having a discontinuous multi-valued best response behavior. The conclusion does not change when 
the response function is an arbitrary continuous single-valued function, as long as the function implies that users 
increasingly choose protection as the level of infection rises. Finally, the conclusion remains valid even when there 
are two classes of users, each class with a different threshold function. These scenarios are studied both theoretically, 
by using a system of differential inclusions or differential equations, and also they are validated with simulations 
on human mobility traces. 

We use the theory of differential inclusions to prove properties (existence, uniqueness, stability) of the system 
trajectories in the case of multivalued response functions. In the case of uniform user behavior, either continuous 
or discontinuous, the system is two-dimensional, and we are able to exclude the existence of periodic trajectories 
and to characterize the domains of attraction for each equilibrium point. 
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